fix local codex review comment:

  - [P0] Respect sessionInputCallback redactions — packages/agents-core/src/runImplementation.ts:1986-1992
    If a session input callback intentionally omits or redacts the new turn inputs (e.g. it returns only the prior history to avoid persisting sensitive data), we
  should not write the raw inputs to the session. However, when appended.length === 0 this code falls back to newInputSnapshot, so we still persist the original turn
  items even though the callback removed them. This leaks exactly the data the developer tried to drop, defeating the purpose of the callback. Please respect the
  callback’s decision by persisting nothing (or only the items it returned) when no new items were appended.

Author: seratch

packages/agents-core/src/run.ts

@@ -493,6 +493,7 @@ export class Runner extends RunHooks<any, AgentOutputType<unknown>> {
           // When the server tracks conversation state we only send the new turn inputs;
           // previous messages are recovered via conversationId/previousResponseId.
           includeHistoryInPreparedInput: !serverManagesConversation,
+          preserveDroppedNewItems: serverManagesConversation,
         },
       );
       if (serverManagesConversation && session) {

packages/agents-core/src/runImplementation.ts

@@ -1908,6 +1908,12 @@ export async function prepareInputItemsWithSession(
      * (e.g. server-managed conversations) to avoid sending duplicated messages each turn.
      */
     includeHistoryInPreparedInput?: boolean;
+    /**
+     * When true, ensures new turn inputs are still provided to the model even if the session input
+     * callback drops them from persistence (used for server-managed conversations that redact
+     * writes).
+     */
+    preserveDroppedNewItems?: boolean;
   },
 ): Promise<PreparedInputWithSessionResult> {
   if (!session) {
@@ -1919,6 +1925,7 @@ export async function prepareInputItemsWithSession(
 
   const includeHistoryInPreparedInput =
     options?.includeHistoryInPreparedInput ?? true;
+  const preserveDroppedNewItems = options?.preserveDroppedNewItems ?? false;
 
   const history = await session.getItems();
   const newInputItems = Array.isArray(input)
@@ -1985,13 +1992,20 @@ export async function prepareInputItemsWithSession(
     appended.push(item);
   }
 
+  // Preserve redacted inputs for model delivery when requested (e.g. server-managed histories).
+  const preparedItems = includeHistoryInPreparedInput
+    ? combined
+    : appended.length > 0
+      ? appended
+      : preserveDroppedNewItems
+        ? newInputSnapshot
+        : [];
+
   return {
-    preparedInput: includeHistoryInPreparedInput
-      ? combined
-      : appended.length > 0
-        ? appended
-        : newInputSnapshot,
-    sessionItems: appended.length > 0 ? appended : newInputSnapshot,
+    preparedInput: preparedItems,
+    // Respect callbacks that intentionally drop the latest inputs (e.g. to redact sensitive
+    // values) by persisting only the items they kept in the combined array.
+    sessionItems: appended,
   };
 }
 

packages/agents-core/test/runImplementation.test.ts

@@ -552,7 +552,7 @@ describe('prepareInputItemsWithSession', () => {
     expect(sessionItems[0]).toBe(newItem);
   });
 
-  it('preserves the latest input when callbacks omit new items entirely', async () => {
+  it('respects callbacks that intentionally drop new inputs', async () => {
     const historyItem: AgentInputItem = {
       type: 'message',
       role: 'user',
@@ -574,13 +574,12 @@ describe('prepareInputItemsWithSession', () => {
       { includeHistoryInPreparedInput: false },
     );
 
-    expect(result.preparedInput).toEqual([newItem]);
+    expect(result.preparedInput).toEqual([]);
     const sessionItems = result.sessionItems;
     if (!sessionItems) {
       throw new Error('Expected sessionItems to be defined.');
     }
-    expect(sessionItems).toEqual([newItem]);
-    expect(sessionItems[0]).toBe(newItem);
+    expect(sessionItems).toEqual([]);
   });
 
   it('persists appended copies when callbacks mutate history in place', async () => {